PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Closer Look at the US-CERT Top 10 Vulnerabilities List

bishopfox.com | blog | #vulnerability-management | #social-engineering | #vpn | #patching | #us-cert | #microsoft-office
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Daniel Wood analyzes US-CERT's top 10 exploited vulnerabilities of 2016-2019: Microsoft Office, VPN flaws, and social engineering dominate, driven by poor patch and configuration management.
Published
Collected

Related coverage

blog · jfrog.com
The Year the Vulnerability Backlog Changed Shape
AI coding tools are swelling vulnerability backlogs at machine speed. Discover how CISOs can adapt supply chain security and governance for the agentic era.
blog · jfrog.com
The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers
Frontier AI models are increasing the number of critical zero-days. Learn how vendors and customers need to change their approach to vulnerability patching.
blog · netspi.com
Leading Financial Institution Leveraged NetSPI Red Team Service to Improve Their Security Posture
NetSPI describes a black box red team engagement for a major US bank's subsidiary: OSINT and a robo-caller vishing attack harvested employee credentials used to attempt VPN access to the network.
blog · netspi.com
A Faster Way to Identify High Risk Windows Assets
Shows how Active Directory computer account properties expose OS and service pack levels queryable by any domain user, enabling faster identification of high-risk unpatched Windows assets.
blog · netspi.com
What Happened to Vulnerability Management?
A NetSPI post argues many organizations still lack real vulnerability management: it outlines the basic cycle of asset inventory, identification, risk-based prioritization, reporting and remediation.
blog · bishopfox.com
Winston Privacy Version 1.5.4
Nine vulnerabilities in the Winston Privacy device 1.5.4 — critical unauthenticated command injection, CSRF, CORS issues, default credentials, undocumented SSH — fixed in 1.5.8.
Back